Skip to main content
Connecting to Clickhouse is very straightforward. You just need to provide the connection string and credentials. If you are using something like Clickhouse Cloud, you can find the connection string in the UI.
Clickhouse Cloud Connection String
If you are making connection credentials just for GrowthBook, you can give it read-only access to the database. If you use GrowthBook Cloud and the destination is behind a firewall, allow inbound traffic from 52.70.79.40/32. That is the only address GrowthBook Cloud connects out from — see IP addresses.

​
SSL and client certificates

Enable Require SSL to connect over HTTPS. A URL without a scheme defaults to https://, and an http:// URL is rejected.
  • CA certificate: paste a CA bundle to verify a server with a private or self-signed certificate. Leave it empty to use the default trusted CAs.
  • Client certificate and key: paste both to use SSL certificate authentication. GrowthBook sends the username and certificate but not the password. If the certificate is signed by an intermediate CA, paste the leaf followed by its intermediates.
Stored certificates are never shown again. To remove one, click Remove stored value under its field and save. The ClickHouse user must accept the certificate’s common name, for example:

​
Certificate file paths (self-hosted only)

On a self-hosted GrowthBook with a single organization, you can point GrowthBook at PEM files on its server instead of pasting certificates. Open Certificate file paths under Require SSL and set any of:
  • CA cert path, Client cert path and Client key path: used instead of the matching pasted value. Set a pasted value or a path for each, not both.
  • Client cert chain path (optional): intermediate CA certificates sent after the client certificate. Set this when the client certificate file contains only the leaf and ClickHouse trusts only the root CA. Otherwise the TLS handshake fails with unknown ca.
GrowthBook reads the files every time it runs a query, so certificates rotated on disk (for example by cert-manager) are picked up without a restart. If you mount them from a Kubernetes Secret, don’t use subPath mounts, because those aren’t updated when the Secret rotates.